Methods and systems for selectively processing virtual local area network (VLAN) traffic from different networks while allowing flexible VLAN identifier assignment

ABSTRACT

Methods and systems for selectively processing VLAN traffic from different networks while allowing flexible VLAN identifier assignment are disclosed. According to one aspect, a layer 2 switch includes a virtual switch identifier data structure that associates a VLAN identifier extracted from a layer 2 frame and a port identifier corresponding to a port on which a frame is received with a virtual switch identifier. The virtual switch identifier is used to select a per-virtual-switch data structure, such as a forwarding table. The per-virtual-switch data structure is used to control processing of the layer 2 frame on a per-virtual-switch basis. The per-virtual-switch data structure may also be updated separately from the data structures assigned to other virtual switches.

PRIORITY CLAIM

This application is a divisional of U.S. patent application Ser. No.10/744,223, filed Dec. 22, 2003, now U.S. Pat. No. 7,693,158 thedisclosure of which is incorporated herein by reference in its entirety.

TECHNICAL FIELD

The present invention relates to methods and systems for selectivelyprocessing VLAN traffic associated with different networks. Moreparticularly, the present invention relates to methods and systems forselectively processing VLAN traffic from different networks whileallowing flexible VLAN identifier assignment.

BACKGROUND ART

VLANs allow different physical local area networks to communicate witheach other using layer 2 switches, rather than layer 3 routers. From amessaging standpoint, VLANs are implemented by inserting a VLANidentifier in a layer 2 frame. Layer 2 switches are configured to switchand control flooding of traffic based on VLAN identifiers. For example,when layer 2 traffic arrives at a switch and has a particular VLANidentifier, if a layer 2 forwarding database entry is not present in theforwarding table for the layer 2 traffic, the layer 2 traffic is onlyflooded onto ports of the switch associated with the same VLANidentifier. Thus, VLAN identifiers are used to control the distributionof layer 2 traffic.

One problem with using VLAN identifiers to control the distribution oflayer 2 traffic occurs when different networks connected to the samelayer 2 switch use the same VLAN identifiers. For example, network A mayassign the VLAN identifier 23 to its layer 2 traffic. Network B may alsoassign the VLAN identifier 23 to its layer 2 traffic. When layer 2frames destined for network A arrive at a layer 2 switch, if a specificlayer 2 forwarding table entry does not exist for the destination innetwork A, the frame intended for the destination in network A will beflooded to networks A and B. Flooding traffic onto another user'snetwork is undesirable for security reasons and it also unnecessarilywastes network bandwidth.

One solution to the problem of VLAN identifier assignment is to requiredifferent networks to use different VLAN identifiers. While assigningseparate VLAN identifiers to separate networks prevents the floodingproblems mentioned above, it unnecessarily limits the VLAN assignmentcapabilities of each network. For example, each network may desire toflexibly assign VLAN identifiers, without regard to VLAN identifiersassigned to other networks. Limiting one network to a specific VLANidentifier or set of VLAN identifiers is undesirable from a serviceprovider perspective because it limits customers and can requirecustomers to reconfigure their internal networks.

Another potential solution to VLAN identifier conflicts is to use avirtual metropolitan area network (VMAN) identifier in addition to VLANidentifiers to segregate traffic from different customers. The VMANidentifier may be added to layer 2 frames upon entry into a layer 2service provider's network. The VMAN identifier is used to switch thetraffic within the layer 2 service provider's network and is removedwhen the traffic leaves the layer 2 service provider's network. However,using VMAN identifiers still does not solve the problem of flexible VLANassignment. For example, if two customers use the same VLAN ID, theremust still be a way to segregate this traffic at the egress point of thelayer 2 service provider's network. Such segregation may require thateach customer be assigned to different VMAN ID upon ingress to the layer2 service provider's network, based on some suitable criteria. Thus,while a VMAN-based solution allows traffic to be switched in a VMANservice provider's network without using VLAN IDs, there still exists aneed for a solution to how to separate the traffic of differentcustomers that use the same VLAN IDs at the ingress and egress points ofthe service provider's network.

Yet another potential solution to the problems of VLAN identifierassignment and traffic segregation is to use access lists to control howtraffic is forwarded on different ports of a switch. For example, anaccess list may specify that only layer 2 traffic from a particular setof MAC source addresses can be forwarded on a particular output port,regardless of the VLAN identifier. Layer 2 access lists can thus controlthe traffic that is sent over each port in a layer 2 switch. However,using access lists is cumbersome because access lists must beimplemented on a per-port basis and must be updated when MAC sourceaddresses change due to equipment changes or when new machines areconnected to the layer 2 switch.

U.S. Pat. No. 6,208,649 to Kloth discloses a derived VLAN mappingtechnique that assigns derived VLAN values based on port VLAN and eitherMAC address or protocol type. In particular, the '649 patent disclosesthat in one embodiment, the protocol type defined in the layer 2 portionof the packet can be combined with the port VLAN to select a derivedVLAN. This embodiment allows packets of different protocol types, suchas IP and IPX, that arrive on the same port to be sent over differentoutput ports. However, this embodiment requires a fixed associationbetween port and VLAN and does not address the problem of two customersdesiring to assign the same VLAN identifier to different ports. If twocustomers use the same VLAN identifier and the same protocol type, theirtraffic will be mixed, according to the solution disclosed in the '649patent. Since a layer 2 service provider should not limit the type oflayer 3 traffic produced by its customers, deriving VLAN values based onprotocol type is undesirable.

In the subnet-based VLAN embodiment described in the '649 patent, the IPsubnet is combined with the port VLAN to determine a derived VLAN value.This embodiment allows VLANs to be divided into different IP subnets.However, this embodiment requires decoding of the IP portion of themessage, which is a layer 3 function, to determine the derived VLAN. Inaddition, a fixed association between port and VLAN is still required.

In a third embodiment, the '649 patent discloses that an index value,rather than the port VLAN can be used to determine the derived VLANvalue. The index value is disclosed as being assigned to the input port.This embodiment is undesirable because it only allows a number derivedVLANs equal to the number of ports in a switch.

Accordingly, in light of the problems associated with conventional VLANidentifier assignment and traffic segregation techniques, there exists along felt need for improved methods and systems for selectivelyprocessing VLAN traffic from different networks while allowing flexibleVLAN identifier assignment.

DISCLOSURE OF THE INVENTION

The present invention includes methods and systems for selectivelyprocessing virtual local area network traffic from different networkswhile allowing flexible VLAN identifier assignment. According to onemethod, each layer 2 frame that arrives at a port of a layer 2 switch isclassified according to its VLAN identifier and the port identifier.More particularly, the VLAN identifier and the port identifier are usedto determine a virtual switch identifier. The virtual switch identifieris then used to select a per-virtual-switch forwarding table forprocessing the layer 2 frame. If a layer 2 frame with the same VLANidentifier arrives on another port, that frame can be processeddifferently because the combination of VLAN identifier and portidentifier for that port will be assigned a different virtual switchidentifier. Assigning a port identifier to VLAN traffic and using theport identifier in combination with the VLAN identifier allows customersto flexibly assign VLAN identifiers without regard to VLAN identifiersassigned to other customers. Such a solution is also more desirable thanthe above-referenced solutions that use protocol type, subnet, and indexvalues to distinguish among VLANs, because customers are free to sendany type of layer 3 traffic without affecting traffic distribution atthe layer 2 switch.

According to another aspect, the present invention includes groupingports of a layer 2 switch into port sets. When a layer 2 frame arrivesat a particular input port, the layer 2 frame is classified to a portset. The combination of port set and VLAN identifier is then used todetermine a virtual switch identifier. The virtual switch identifier isthen used to select per-virtual-switch forwarding tables. Using portsets to classify incoming layer 2 frames reduces the frameclassification lookup time and expense over a solution that uses thecombination of port identifier and VLAN identifier. For example, alookup table based on port ID/VLAN ID combinations and that is notdivided into port sets will be much larger that a lookup table based onport sets. As a result, more memory is required, thus increasing theexpense of the forwarding device.

Accordingly, it is an object of the invention to provide methods andsystems for selectively processing VLAN traffic from different networkswhile allowing flexible VLAN identifier assignment.

It is another object of the invention to provide methods for classifyinglayer 2 traffic that reduce virtual switch ID lookup table size.

Some of the objects of the invention having been stated hereinabove, andwhich are addressed in whole or in part by the present invention, otherobjects will become evident as the description proceeds when taken inconnection with the accompanying drawings as best described below.

BRIEF DESCRIPTION OF THE DRAWINGS

Preferred embodiments of the invention will now be explained withreference to the accompanying drawings:

FIG. 1 is a block diagram illustrating a layer 2 network and a layer 2switch in which embodiments of the present invention may be implemented;

FIG. 2 is a block diagram illustrating an exemplary internalarchitecture of a layer 2 switch including a virtual switch identifierand per-virtual-switch message processing data structures according toan embodiment of the present invention;

FIG. 3 is a flow chart illustrating exemplary steps for selectivelyprocessing layer 2 traffic from different networks while allowingflexible VLAN identifier assignment according to an embodiment of thepresent invention;

FIG. 4 is a flow chart illustrating exemplary steps for classifying andprocessing layer 2 frames based on port identifier and VLAN identifieraccording to an embodiment of the present invention;

FIG. 5 is a flow chart illustrating exemplary steps for classifying andprocessing layer 2 frames based on port identifier or VLAN identifieraccording to an embodiment of the present invention;

FIG. 6 is a block diagram illustrating exemplary grouping of ports intoport sets in a layer 2 switch according to an embodiment of the presentinvention;

FIG. 7 is a flow chart illustrating exemplary steps for classifying andprocessing layer 2 frames based on port identifiers, VLAN identifiers,and port set identifiers according to an embodiment of the presentinvention;

FIG. 8 is a flow chart illustrating exemplary steps for classifying andprocessing layer 2 frames that combines the embodiments illustrated inFIGS. 5-7; and

FIG. 9 is a block diagram illustrating an exemplary hardwareimplementation of the steps illustrated in FIG. 8.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 is a block diagram of a layer 2 switch in which the methods andsystems of the present invention may be implemented. In FIG. 1, layer 2switch 100 includes a plurality of ports numbered 1-n. As used herein,the term “port” refers to the physical point of entry for a networkcable in a layer 2 switch. According to the present invention, each portin layer 2 switch 100 is assigned a port identifier. The port identifiermay be added to a layer 2 frame upon entry into layer 2 switch 100. Aswill be described in detail below, the port identifier may be used incombination with a VLAN identifier to allow customers to flexibly assignVLAN identifiers without regard to VLAN identifiers assigned to othercustomers of the service provider that operates the layer 2 switch.

In the example illustrated in FIG. 1, Customer A uses VLAN identifier 23on port 1. Customer B uses VLAN identifier 15 on port 2. Thus, trafficfrom Customer A on port will not be flooded to Customer B on port 2,since different VLAN identifiers are used. However, Customer C uses VLANidentifier 23 on port 3. Without the present invention or another VLANmapping technique, layer 2 traffic from Customer A's network would beflooded onto Customer C's network and vice versa. However, according tothe present invention, the port identifier is used in combination withthe VLAN identifier to determine a virtual switch identifier. Thevirtual switch identifier is then used to select per-virtual-switch datastructures, and the message is processed using the per-virtual-switchdata structures. As a result, traffic associated with differentcustomers can be isolated, even though the customers use the same VLANID and the customers are connected to the same layer 2 switch. It shouldalso be noted that in FIG. 1, customers can share ports. However, thecombination of port and VLAN identifier is preferably unique in theimplementation illustrated in FIG. 1.

FIG. 2 is a block diagram illustrating an exemplary internalarchitecture of layer 2 switch 100 in FIG. 1 in more detail. Referringto FIG. 2, layer 2 switch 100 includes a classification engine 200 and aswitch fabric 202. Classification engine 200 performs packetclassification functions, such as determining the output port to which apacket should be forwarded, determining the quality of service thatshould be given to a packet, determining output ports to which a packetshould be flooded, etc. In the present embodiment, classification engine200 includes a virtual switch identification module 202 for identifyinga virtual switch for each incoming layer 2 frame and a virtual switchframe processor 204 for processing incoming frames based on the virtualswitch identifier. In addition, classification engine 200 includes avirtual switch identification table 206 containing data for identifyinga virtual switch for each incoming packet and per-virtual-switchprocessing data 208 for processing frames according to the identifiedvirtual switch. Table 206 may be indexed based on port identifiers andVLAN identifiers, as described above. In an alternate implementation,table 206 may be indexed based on port identifier if all VLANs on aparticular port are assigned to the same virtual switch. In such animplementation, if it is determined that all VLANs on a particular portare not assigned to a virtual switch, virtual switch ID table 206 may beaccessed based on VLAN identifier. In yet another alternateimplementation, virtual switch ID table 206 may be indexed based on VLANidentifier and port set identifier. In yet another alternateimplementation, combinations of these indexing methods may be used. Eachof these indexing methods will be described in more detail below.

Per-virtual-switch processing data 208 may include a layer 2 forwardingdatabase for each virtual switch. In addition, per-virtual switchprocessing data 208 may include per-virtual-switch address resolutionprotocol (ARP) caches and per-virtual-switch spanning tree data. Switchfabric 202 switches frames between input and output ports. In addition,switch fabric 202 may forward frames that require additional processingto a CPU.

FIG. 3 is a flow chart illustrating the overall steps performed inallowing users to flexibly assign VLAN identifiers and in selectivelyprocessing packets in a level 2 switch that allows such flexibleassignments. Referring to FIG. 3, in step 300, customers are allowed toselect VLAN identifiers independently of VLAN identifiers assigned toother customers. As used herein, the term “customers” refers consumersof layer 2 services who are connected to the same layer 2 switch.Because the present invention allows such customers to select VLANidentifiers independently of VLAN identifiers assigned to othercustomers, provided the customers are connected to different ports, thelevel 2 service provider does not constrain customer VLAN selection.

In step 302, the VLAN identifiers and the corresponding port identifiersare provisioned in the virtual switch ID table. As stated above, eachunique combination of VLAN identifier and port identifier may beassigned to a virtual switch. In step 304, separate message processingdata structures are maintained for each virtual switch. These messageprocessing data structures may include layer 2 forwarding databases, ARPcaches, and spanning tree data. It is important to maintain separateforwarding databases and ARP caches to prevent frames intended for oneVLAN from being sent over another VLAN. In addition, MAC addresslearning, ARP broadcasting, forwarding of spanning tree bridge protocoldata units are preferably also limited to each virtual switch to preventmachine addresses in one network from being learned by another network.

Accordingly, in step 306, layer 2 frames are processed using datastructures assigned to their respective virtual switch identifiers. Instep 308, data structures, such as forwarding databases, spanning treedata, and ARP caches are updated on a per-virtual-switch basis. Thisupdating may occur based on MAC address learning, ARPing, orparticipating in spanning tree protocols on a per virtual switch basis.

Using the steps illustrated in FIG. 3, a plurality of differentfunctions can be performed on a per-virtual-switch basis, whichincreases security and flexibility in VLAN assignment. Examples of suchper-virtual-switch functions are as follows:

-   -   1) Layer 2 bridging: Separate sets of layer 2 forwarding        databases are maintained for each virtual switch. The incoming        virtual switch index is used to select the correct set of        entries.    -   2) Layer 2 MAC address learning: The virtual switch index        associated with a received layer 2 frame containing a new MAC        source address is used to limit forwarding database updates to        the set of layer 2 forwarding database entries associated with        that virtual switch. Using standard MAC protocols, when a layer        2 frame with a new MAC source address is received, the layer 2        forwarding database used for traffic on all ports is updated. If        VLANs are used, updates can be limited to per-VLAN forwarding        tables. However, if customers use the same VLAN identifiers,        forwarding tables for each network that uses the same VLAN        identifier will be updated. As a result, any layer 2 frame that        is addressed to the learned MAC source address will be forwarded        to that MAC source address even if the layer 2 frame is from a        different network.    -   The present invention eliminates this problem by limiting such        learning to a per-virtual-switch basis. For example, when a        layer 2 frame with a new MAC source address is received, only        the forwarding data corresponding to the virtual switch assigned        to the received frame is updated. As a result, VLAN traffic from        different networks will be segregated and security will be        enhanced.    -   3) Layer 2 flooding: In conventional layer 2 networks, if a        frame is received for which no entry exists in the layer 2        forwarding database, the packet is flooded on all ports. VLAN        identifiers have been used to constrain such flooding to ports        that are associated with the same VLAN. However, as discussed        above, if two service providers use the same VLAN identifier,        frames intended for one service provider may be flooded onto the        network of the other service provider.    -   The present invention avoids this difficulty by limiting such        flooding to a per-virtual-switch basis, even when two customers        have the same VLAN identifier. For example, when a layer 2 frame        is received, the virtual switch identifier is determined and        used to access the forwarding data for that virtual switch. If a        forwarding database entry for the received MAC destination        address does not exist, the frame is flooded only onto ports        associated with the same virtual switch. As a result, security        is increased and network bandwidth is more efficiently utilized.    -   4) ARPing: Using the standard address resolution protocol or        ARP, when an IP packet arrives, an ARP cache containing IP to        physical address mappings from recent ARP requests is accessed        to determine the MAC address corresponding to the IP address. If        the ARP cache does not contain an entry corresponding to the IP        address, the machine that received the packet will broadcast an        ARP request on all ports. The ARP request includes the IP        address and MAC address of the sender so that all of the        receiving machines can update their ARP caches with that        information. The machine that has the particular IP address        responds with its MAC address.    -   5) Proxy ARPing: Proxy ARP is a refinement to the ARP protocol        that allows a single IP network prefix to correspond to two        different physical addresses on different networks. For example,        a router may interconnect two networks that share an IP address.        When a machine on network A desires to contact a machine on        network B, the machine on network A may send an ARP request to        the router. The router responds with its own physical address,        proxying the ARP request for the machine on network B. Machine A        receives the ARP reply, sends packet to the router, and the        router forwards the packet to the machine on network B. The        router must maintain mappings of which machines lie on which        network in order to properly route packets. Thus, proxy ARP        allows two different physical networks to appear as a single        network. The present invention preferably maintains proxy ARP        data on a per virtual switch basis to ensure that conflicts        between networks do not occur if different networks use the same        IP addresses.    -   If ARP requests and replies are sent to networks of different        customers, customers on one network can learn IP and physical        addresses assigned to other networks. Such cross-customer        address learning may be undesirable for security reasons.    -   The present invention avoids these difficulties by limiting,        ARPing and maintaining separate ARP caches for each virtual        switch. In other words, ARP requests are only sent to machines        associated with the same virtual switch as the sending node. In        addition, ARP caches are maintained on a per-virtual-switch        basis. As a result, customers will only have access to IP to        physical address mappings in their own networks.    -   6) Spanning Tree Protocol (STP): Yet another data structure that        may be maintained on a per-virtual-switch basis is spanning tree        data. Spanning tree data includes layer 2 topology and root node        information maintained by each node. This data is used to detect        and prevent looping. It is undesirable for security reasons and        inefficient for STP data to be shared by different networks. For        example, a spanning tree bridge protocol data unit (BPDU) may        include all of a sender's MAC source addresses, ports, and path        costs from each port to the root switch. Such data units are        distributed to all switches in a LAN and used to build a        spanning tree for the LAN. If VLANs are used, spanning tree data        can be shared among switches in the same VLAN. However, if VLAN        conflicts occur, spanning tree data will be shared across        networks, causing security problems and wasting network        bandwidth.    -   The present invention avoids this problem by maintaining        spanning tree data on a per-virtual-switch basis and limiting        spanning tree BPDU distribution to switches within the same        virtual switch. For example, when a spanning tree BPDU is        received, a virtual switch identifier is determined based on the        port and VLAN IDs. Spanning tree data is then updated only for        that virtual switch. Similarly, when spanning tree BPDUs are        sent, they only include information regarding ports associated        with the same virtual switch as the sending virtual switch and        are only sent on ports associated with that virtual switch. By        maintaining per-virtual-switch spanning trees, network security        is increased and bandwidth is more efficiently utilized.

Virtual Switch Identifier Lookup Variations

As stated above, in one implementation of the invention, a virtualswitch identifier may be determined by performing a lookup based on acombination of full port identifier and VLAN identifier. FIG. 4 is aflow chart illustrating exemplary steps that may be performed inassigning virtual switch identifiers based on full port identifiers andVLAN identifiers and selectively processing the frames using suchidentifiers. Referring to FIG. 4, in step 400, a layer 2 frame isreceived at a port of a layer 2 switch. In step 402, a port identifieris assigned to the layer 2 frame. In step 404, the VLAN identifier isextracted from the layer 2 frame. In step 406, a lookup is performed inthe virtual switch identifier table using the VLAN ID and the port IDcombination. The virtual switch identifier is extracted and, in step408, a per-virtual-switch data structure is accessed. Such datastructures may include forwarding databases, ARP caches, etc. In step410, the frame is processed using the per-virtual-switch data structure.For example, the frame may be forwarded or flooded to a node or nodesassociated with the same virtual switch. In step 412, theper-virtual-switch data structures are updated.

Thus, using the steps illustrated in FIG. 4, frames can be selectivelyprocessed and data structures can be selectively updated based on thecombination of VLAN ID and port ID. While this solution provides thegreatest flexibility in terms of end user VLAN ID selection, it canresult in a large virtual switch ID table size. For example, in a layer2 switch that includes 2048 ports and the VLAN ID is 12 bits, theresulting virtual switch ID table size is 2048* 4096=8M table entries.If it is desirable to reduce the table size, some input ports may beassigned to a single virtual switch and the VLAN ID may be used todetermine the virtual switch ID for other ports. In this solution, thevirtual switch ID table size is reduced to 2048 ports+4096 VLANs=6144table entries. This decrease in lookup table size is at the expense offlexibility in VLAN identifier assignment. For example, on ports forwhich all VLANs are not assigned to the same virtual switch, two serviceproviders cannot use the same VLAN ID. However, the number of availablevirtual switch identifiers is 6144 versus 4096 if the VLAN ID is usedalone.

FIG. 5 is a flow chart illustrating exemplary steps that may beperformed by a layer 2 switch in assigning virtual switch identifiersusing the port-based or VLAN-based virtual switch assignment schemedescribed above. Referring to FIG. 5, in step 500, the layer 2 switchreceives a layer 2 frame at one of its ports. In step 502, the layer 2switch assigns a port ID to the frame based on the input port. In step504, the layer 2 switch determines whether the port is assigned to asingle virtual switch. If the port is assigned to a single virtualswitch, control proceeds to step 506 where a lookup is performed in thevirtual switch identifier table using the port ID. The virtual switchidentifier corresponding to the port identifier is extracted. Controlthen proceeds to steps 508 through 512 where the per-virtual-switch datastructures are accessed, the frame is processed using theper-virtual-switch data structures, and the data structures for thevirtual switch are updated.

Returning to step 504, if the port is not assigned to a single virtualswitch, control proceeds to step 514 where a lookup is performed in thevirtual switch ID table using the VLAN ID. Control then proceeds to step508 through 512 where the frame is processed using per-virtual-switchprocessing data and the data is updated.

In yet another alternate implementation of the invention, the virtualswitch identifier may be determined using a hierarchical approach basedon a port set identifier. FIG. 6 is block diagram illustrating the portset identifier concept. In FIG. 6, the ports on a layer 2 switch areassigned to port sets 0, 1, 2, and 3. Each combination of port set andVLAN identifier is then assigned to a virtual switch. By partitioningthe layer 2 switch into port sets, ports can be shared among differentcustomers, provided that the customers are assigned different portset-VLAN ID combinations. For example, in FIG. 6, virtual switch A maybe assigned to Customer A, virtual switch B may be assigned to CustomerB, and virtual switch C may be assigned to Customer C. Customers A and Bcan both use the ports in port set 1, because Customers A and B usedifferent VLAN identifiers. However, Customers A and C cannot use thesame ports because Customers A and C use the same VLAN identifiers.

FIG. 7 is a flow chart illustrating exemplary steps for selectingvirtual switch identifiers based on port set identifiers and VLANidentifiers and processing frames using the virtual switch identifiers.Referring to FIG. 7, in step 700, the layer 2 switch receives a layer 2frame at one of its ports. In step 702, the switch assigns a port ID tothe frame based on the port on which the layer 2 frame was received. Instep 704, a port set is determined based on the port ID. As discussedabove, the ports may be grouped into port sets to reduce the lookuptable size.

In step 706, a lookup is performed in the virtual switch ID table usingthe VLAN ID and the port set identifier. Once the virtual switch ID isdetermined, in step 708, 710, and 712, the frame is processed using theper-virtual-switch data structures and the data structures are updated.Thus, by performing a hierarchical lookup based on port set ID, thepresent invention reduces the virtual switch ID lookup table size yetstill provides flexibility in VLAN identifier assignment.

In yet another alternate implementation of the invention, thehierarchical lookup in FIG. 7 can be combined with the methodillustrated in FIG. 5. FIG. 8 is a flow chart illustrating thiscombination of processing steps according to an embodiment of thepresent invention. Referring to FIG. 8, in step 800, a layer 2 frame isreceived at a port in a layer 2 switch. In step 802, a port ID isassigned to the frame based on the input port. In step 804, it isdetermined whether all VLANs on the port are assigned to the samevirtual switch. If all VLANs on the port are assigned to the samevirtual switch, control proceeds to step 806 where the virtual switch IDtable is accessed using the port ID. Control then proceeds to steps 808through 812 where the frame is processed using the per-virtual-switchdata structures and the data structures for that virtual switch areupdated.

Returning to step 804, if all VLANs on the port are not assigned to thesame virtual switch, control proceeds to step 814 where the port set IDis determined using the port ID. As discussed above, ports may begrouped into port sets to reduce the size of the virtual switch IDtable. In step 816, a lookup is performed in the virtual switch ID tablebased on the VLAN ID and the port set ID. Once the virtual switchidentifier is determined, control proceeds to steps 808 through 812where the frame is processed using per-virtual-switch data and thecorresponding data structures are updated.

Any of the virtual switch ID lookup methods described with respect toFIGS. 4-8 may be implemented in hardware, software, firmware or anycombination thereof. FIG. 9 is a block diagram illustrating a hardwareimplementation of the combined lookup method described with regard toFIG. 8. It is understood that portions of the hardware illustrated inFIG. 9 may also be used to implement the processing steps illustrated inany of FIGS. 4, 5, 7, and 8. Referring to FIG. 9, a received layer 2frame 900 is assigned a port identifier 902 upon entry into a layer 2switch. The port identifier may be added to the frame. Decision block904, which may be implemented using a lookup table orcontent-addressable memory (CAM), receives the port identifier as inputand produces a first output signal indicating whether or not all VLANson the port are assigned to the same virtual switch. If all VLANs on thesame port are assigned to the virtual switch, block 904 also outputs aport-based virtual switch ID. If all VLANs on a port are not assigned tothe same virtual switch, block 904 determines a port set ID based on theport ID.

Block 906, which may be implemented using a lookup table or CAM,receives as input the port set ID and the VLAN ID and outputs a port setand VLAN-based virtual switch ID. The signals port-based_VS_ID andPORT_SET+VLAN-based_VS_ID are input into multiplexer 908. The signalall_on_1 is used to select the input of multiplexer 908 that will becoupled to the output port. For example, if the selector input all_on_1indicates that all VLANs on a particular port are assigned to the samevirtual switch, the output signal VS_ID is equal to the port-based_VS_IDinput signal. If the signal all_on_1 indicates that all VLANs on aparticular port are not assigned to the same virtual switch, the signalPORT_SET+VLAN-BASED_VS_ID is coupled to the output port.

The output of multiplexer 908, which is the virtual switch ID, is inputinto forwarding database 910. Forwarding database 910 also receives asinput the MAC destination address. Using the virtual switch ID incombination with the MAC destination address allows the portion offorwarding database 910 that is specific to the virtual switch to beselected. It is understood that forwarding database 910 may includeseparate lookup tables for each virtual switch or separate blocks ofdata for each virtual switch. Any organization of data on aper-virtual-switch basis is intended to be within the scope of theinvention. The output of forwarding database 910 may be an output port,a flood list, or a multicast list, depending on the output of thelookup.

Thus, the present invention includes methods and systems that allowframes associated with different VLANs to be selectively processed whileallowing flexible customer VLAN identifier assignment. The presentinvention uses the combination of port ID and VLAN ID to determine avirtual switch identifier for each incoming frame. The frames are thenprocessed on a per-virtual-switch basis and data structures aremaintained and updated on a per-virtual-switch basis. The presentinvention also includes various virtual switch identifier lookup methodsand data structures for decreasing virtual switch ID lookup time.

The present invention is not limited to expressly identifying a virtualswitch based on port/VLAN or port set/VLAN combination. It is understoodthat the combination of identifiers can be used to implicitly identify avirtual switch and select the appropriate data structures withoutdeparting from the scope of the invention.

It will be understood that various details of the invention may bechanged without departing from the scope of the invention. Furthermore,the foregoing description is for the purpose of illustration only, andnot for the purpose of limitation, as the invention is defined by theclaims as set forth hereinafter.

What is claimed is:
 1. A layer 2 switch for allowing flexible assignmentof VLAN identifiers and selectively processing traffic from differentVLANs, the layer 2 switch comprising: (a) a plurality of ports, eachport being assigned a port identifier; (b) a classification enginecoupled to the plurality of ports, the classification engine including avirtual switch identification module for identifying a virtual switchcorresponding to a first received layer 2 frame based on a portidentifier corresponding to a first port on which the first layer 2frame is received and a first VLAN identifier extracted from the firstreceived layer 2 frame, wherein the virtual switch identification moduleis configured to assign a second virtual switch identifier to a secondlayer 2 frame having the first VLAN identifier and arriving at a secondport of the layer 2 switch; (c) a virtual switch identification datastructure being accessible by the virtual switch identification modulefor assigning a virtual switch identifier to the received layer 2 frame;(d) a virtual switch frame processor operatively associated with thevirtual switch identification module for selectively processing thereceived first and second layer 2 frames based on the first and secondvirtual switch identifiers, wherein selectively processing the first andsecond received layer 2 frames includes forwarding the first layer 2frame to a different output port from the second layer 2 frame based onthe first and second virtual switch identifiers; and (e) aper-virtual-switch data structure accessible by the virtual switch frameprocessor containing data for selectively processing the received firstand second layer 2 frames.
 2. The layer 2 switch of claim 1 wherein thevirtual switch identification data structure is indexed by a combinationof port identifier corresponding to a port on which the first or secondlayer 2 frame is received and VLAN identifier extracted from the firstor second layer 2 frame and wherein the virtual switch identificationmodule is adapted to assign a virtual switch identifier to the receivedfirst or second layer 2 frame by performing a lookup in the virtualswitch identification data structure based on the port identifiercorresponding to the port on which the first or second layer 2 frame isreceived and the VLAN identifier extracted from the received first orsecond layer 2 frame.
 3. The layer 2 switch of claim 1 wherein thevirtual switch identification data structure is indexed by a combinationof port set identifier corresponding to a port set in the layer 2 switchand VLAN identifier extracted from the received first or second layer 2frame and wherein the virtual switch identification module is adapted toassign a virtual switch identifier to the received first or second layer2 frame by performing a lookup in the virtual switch identification datastructure using a port set identifier identifying a port set on whichthe first or second layer 2 frame is received and a VLAN identifierextracted from the received first or second layer 2 frame.
 4. The layer2 switch of claim 1 wherein the virtual switch identification datastructure is indexed by port ID and VLAN ID, wherein the virtual switchidentification module is adapted to determine whether all VLANs on aport on which the first or second layer 2 frame is received correspondto the same virtual switch and, in response, to access the virtualswitch identification data structure using the port set ID, and, inresponse to determining that all VLANs on a port on which the first orsecond layer 2 frame is received do not correspond to the same virtualswitch, to access the virtual switch identification data structure basedon the VLAN identifier extracted from the received first or second layer2 frame.
 5. The layer 2 switch of claim 4 wherein, in response todetermining that all VLANs on the port on which the first or secondlayer 2 frame is received do not correspond to the same virtual switch,the virtual switch identification module is adapted to access thevirtual switch identification data structure based on the port setidentifier in addition to the VLAN identifier.
 6. The layer 2 switch ofclaim 1 wherein the per-virtual-switch data structure includes aper-virtual-switch layer 2 forwarding database and wherein the virtualswitch frame processor is adapted to process the received first orsecond layer 2 frame using the per-virtual-switch layer 2 forwardingdatabase.
 7. The layer 2 switch of claim 1 wherein the virtual switchframe processor is adapted to perform layer 2 media access control (MAC)address learning on a per-virtual-switch basis.
 8. The layer 2 switch ofclaim 1 wherein the virtual switch frame processor is adapted to performlayer 2 flooding on a per-virtual-switch basis.
 9. The layer 2 virtualswitch of claim 1 wherein the virtual switch identification datastructure includes a first VLAN value assigned to a first customer on afirst port and which is assigned to a second customer on a second portand wherein the virtual switch identification data structure associatesfirst and second virtual switch identifiers with the first and secondcustomers.
 10. The layer 2 switch of claim 9 wherein the virtual switchframe processor is adapted to process layer 2 frames received from thefirst customer differently from layer 2 frames received from the secondcustomer based on the first and second virtual switch identifiers.
 11. Alayer 2 switch for allowing flexible assignment of VLAN identifiers andselectively processing traffic from different VLANs, the layer 2 switchcomprising: (a) a plurality of ports, each port being assigned a portidentifier; (b) a classification engine coupled to the plurality ofports, the classification engine including a virtual switchidentification module for identifying a virtual switch corresponding toa received layer 2 frame based on a port identifier corresponding to aport on which the layer 2 frame is received and a VLAN identifierextracted from the received layer 2 frame; (c) a virtual switchidentification data structure being accessible by the virtual switchidentification module for assigning a virtual switch identifier to thereceived layer 2 frame; (d) a virtual switch frame processor operativelyassociated with the virtual switch identification module for selectivelyprocessing the received layer 2 frame based on the virtual switchidentifier; and (e) a per-virtual-switch data structure accessible bythe virtual switch frame processor containing data for selectivelyprocessing the received layer 2 frame; wherein the per-virtual-switchdata structure includes a per-virtual-switch address resolution protocol(ARP) cache and wherein the per-virtual-switch frame processor isadapted to process the received layer 2 frame using theper-virtual-switch ARP cache.
 12. A layer 2 switch for allowing flexibleassignment of VLAN identifiers and selectively processing traffic fromdifferent VLANs, the layer 2 switch comprising: a plurality of ports,each port being assigned a port identifier; (b) a classification enginecoupled to the plurality of ports, the classification engine including avirtual switch identification module for identifying a virtual switchcorresponding to a received layer 2 frame based on a port identifiercorresponding to a port on which the layer 2 frame is received and aVLAN identifier extracted from the received layer 2 frame; (c) a virtualswitch identification data structure being accessible by the virtualswitch identification module for assigning a virtual switch identifierto the received layer 2 frame; (d) a virtual switch frame processoroperatively associated with the virtual switch identification module forselectively processing the received layer 2 frame based on the virtualswitch identifier; and (e) a per-virtual-switch data structureaccessible by the virtual switch frame processor containing data forselectively processing the received layer 2 frame; wherein theper-virtual-switch data structure includes per-virtual-switch spanningtree data and wherein the virtual switch frame processor is adapted tomaintain separate spanning tree data for each virtual switch identifier.